1. Field of the Invention
The invention disclosed herein relates, in general, to network equipment configuration. More specifically, the present invention relates to a method of configuring customer premise equipment securely.
2. Description of the Related Art
Communication technology has turned around the way people carry out their day to day activities. Particularly, emergence and penetration of various broadband access technologies has made life convenient and has definitely changed the way we work, communicate, and socialize.
Various broadband access technologies such as Digital Subscriber Lines (DSL), Integrated Services Digital Network (ISDN), Leased Lines, Fiber-to-the-home (FTTH), Satellite Broadband and the like are used by Internet Services Providers (ISPs) to provide broadband access to customer premises. In order to deliver the broadband access, ISPs set-up a Customer Premise Equipment (CPE) at customer premises. Each ISP configures the CPE to enable the broadband services.
Currently, most of the ISPs rely on Low-Touch-Provisioning feature to configure the CPE. This feature relies on the use of Dynamic Host Configuration Protocol (DHCP) to provide every node connected to the CPE with an IP address and a location to obtain its configuration. Further, each node may use Trivial File Transfer Protocol (TFTP) to download a configuration file and self-configures itself based on the configuration file. Alternatively, the DHCP standard allows BOOTP and HTTP methods for collecting configuration files, but these methods are unencrypted, which presents a challenge for ISPs.
When the ISP allows the use of TFTP instead of BOOTP or HTTP for downloading the configuration file, it works well only for the ISPs that allow use of unencrypted protocols such as TFTP. However, ISPs having strict security policies and firewalls usually prohibit use of unencrypted protocols such as TFTP, thereby preventing use of Low-Touch-Provisioning capabilities.
To counter this problem, some ISPs rely on encrypted file transfer protocols such as Secure File Transfer Protocol (SFTP). SFTP further requires that the credentials must be installed on the node. However, this technique is also not deployable in most of the environments because it is not easy to manage the credentials for large number of installations and becomes a logistical challenge for the ISP. Further, since this technique uses static credentials, it is prone to security threats.
There are some other techniques based on TR-069 standard that use HTTP server or TFTP server for downloading the configuration file, however, these techniques are also prone to aforementioned problems.
According to the foregoing discussion, it can be observed that the existing methods and techniques used for configuring CPE have one or more limitations. Firstly, these techniques are not secure. Secondly, these techniques are difficult to manage at both factory level and deployment level. In light of this, there is a need for a method for securely configuring customer premise equipment, which overcomes some or all of the limitations identified above.